CMS ISWEB 3.5.3 SQL Injection

🗓️ 27 Sep 2018 00:00:00Reported by Thiago SenaType

packetstorm🔗 packetstormsecurity.com👁 54 Views

CMS ISWEB 3.5.3 SQL Injection vulnerability allows remote attackers to execute code and disclose sensitive informatio

Reporter	Title	Published	Views	Family All 6
CNVD	CMS ISWEB SQL Injection Vulnerability	17 Oct 201800:00	–	cnvd
CVE	CVE-2018-14956	28 Sep 201800:00	–	cve
Cvelist	CVE-2018-14956	28 Sep 201800:00	–	cvelist
EUVD	EUVD-2018-6838	7 Oct 202500:30	–	euvd
NVD	CVE-2018-14956	28 Sep 201800:29	–	nvd
Prion	Sql injection	28 Sep 201800:29	–	prion

`[Description]  
CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker  
can inject malicious queries into the application and obtain  
sensitive information.  
  
------------------------------------------  
  
[Additional Information]  
PoC Prints: https://imgur.com/a/buXJJKC  
?id=1'  
  
------------------------------------------  
  
  
[Vulnerability Type]  
SQL Injection  
  
------------------------------------------  
  
[Vendor of Product]  
http://www.isweb.it CMS ISWEB 3.5.3  
  
------------------------------------------  
  
[CVE Name]  
CVE-2018-14956  
  
------------------------------------------  
  
[Attack Type]  
Remote  
  
------------------------------------------  
  
[Impact Code execution]  
true  
  
------------------------------------------  
  
[Impact Information Disclosure]  
true  
  
------------------------------------------  
  
[CVE Impact Other]  
The attacker can access the entire database, get shell and remote code execution.  
  
------------------------------------------  
  
[Reference]  
https://www.owasp.org/index.php/SQL_Injection  
  
------------------------------------------  
  
[Discoverer]  
Thiago Sena & Rafael Fontes Souza & Occasio Security  
  
  
  
`

27 Sep 2018 00:00Current

9.7High risk

Vulners AI Score9.7

EPSS0.00394